Re: role infrastructure

[Daniel J Walsh <dwalsh@redhat.com>]

Bringing this out for full discussion.

Christopher J. PeBenito wrote:
> Dan, can you give me a run down of:
>
> 1. how you want to be able to configure user roles
> 2. things that fc/rhel users request for user role customization
>   
Good question I think this is more a brain storming exercise, which I 
don't necessarily have the knowledge or
experience to answer.

What I have heard is for Sarbanes Oxley, groups want to be allowed to 
have administrators that can get root privs in order to
configure certain facets of the system, but not full control.

So you could imagine a webadmin, nameserveradmin, dhcpadmin as 
examples.  Then I believe they would like to use
dominance in some way to group them.  netadmin = { nameserveradmin 
dhcpadmin }.

My idea is that we give these administrators full control over the types 
defined for these domains, and allow them to use all of the
standard tools for configuring (vi, emacs, basically anything labeled 
bin_t.)

To make this useful in a Targeted policy system, we might do something 
to sudo to get a transition to happen.

So dwalsh can run a root shell but only in the webadm_r  unconfined_t 
would transition to webadm_r.

Thoughts?

Dan


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.